Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Upgrade flow-bin and set-value #26

Merged
merged 3 commits into from
Sep 23, 2021
Merged

Upgrade flow-bin and set-value #26

merged 3 commits into from
Sep 23, 2021

Conversation

joshuanapoli
Copy link
Contributor

Summary

  • Upgrade to flow-bin@^0.142.0
  • Solve CVE-2021-23440 by upgrading to set-value@^4.0.1

Details

The flow-bin upgrade aligns with other Cumulus packages.

Fixing in upstream dependencies is complicated because of changing semantics in set-value when setting the undefined value on objects. See jonschlinkert/cache-base#22 (comment)

It is safe enough for us to override the set-value package version using package.json resolutions.

Testing

The set-value dependency only used in the dev infrastructure, not production code. A green build should give us enough confidence to accept this change.

@joshuanapoli joshuanapoli merged commit ed51e67 into master Sep 23, 2021
@joshuanapoli joshuanapoli deleted the flow/0.142.0 branch September 23, 2021 18:08
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants